feat(config-api): session endpoint changes for search in jansSessAttr JSON

[pujavs]

Prepare

• Read PR guidelines
• Read license information

---

Description

Issue#9856: Changes in search endpoint to support search based on jansSessAttr field.

Target issue

closes #9856

Implementation Details

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The pull request enhances the session management functionality of the Jans Config API application, including session attribute filtering, improved session retrieval and modification, session token revocation, and documentation updates to clarify access control permissions.

Expand for full summary

Summary:

The changes in this pull request focus on enhancing the session management functionality of the Jans Config API application. The key changes include:

1. Session Attribute Filtering: The application can now filter and search sessions based on specific attributes, such as acr, scope, auth_user, client_id, acr_values, redirect_uri, and response_type. This can be useful for security-related tasks, such as auditing user sessions or investigating potential security incidents.

2. Improved Session Retrieval and Modification: The code changes include updates to session-related operations, such as retrieving, modifying, and deleting sessions. These improvements can help ensure that session-related functionality is performed correctly and securely.

3. Session Token Revocation: The application now has the ability to revoke all access and ID tokens associated with a specific session, which is an important security feature for mitigating the risk of unauthorized access if a session is compromised.

4. Documentation Updates: The changes also include updates to the Jans Config API Swagger documentation, which clarify the access control permissions for the application, particularly the "White Pages" or user directory access.

Overall, these changes appear to be focused on improving the security and manageability of the application's session management functionality, which is a crucial aspect of application security. The changes do not introduce any obvious security risks and seem to be a positive step towards enhancing the application's security posture.

Files Changed:

1. jans-config-api/server/src/main/java/io/jans/configapi/service/auth/SessionService.java:

   • Added session attribute filtering functionality
   • Improved session retrieval and modification methods
   • Implemented session token revocation and deletion capabilities

2. jans-config-api/docs/jans-config-api-swagger.yaml:

   • Renamed the userCanEdit field to whitePagesCanView in the PatchRequest schema
   • Reordered the fields in the PatchRequest schema, moving whitePagesCanView before adminCanEdit, userCanEdit, and userCanView

Code Analysis

We ran 9 analyzers against 2 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	2 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[sonarcloud]

Quality Gate passed for 'jans-config-api-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'jans-cli'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud